There are massive holes in most government institutions. You just need to encounter them.
Just one example from many of the Australian government failings:
You may receive a phonecall from Centrelink. It'll be from a private number, so there's no need to even spoof it. They ask for your date of birth, Centrelink ID and address to validate you, which just also happens to be everything you need to steal someone's account.
If you refuse to identify without them first identifying, or if you ask if you can call Centrelink directly to be reconnected, you'll find, you can't.
I received a call from Centrelink, in a week when I also received three other calls purporting to be from Centrelink. I can't tell you which one was the legitimate one, just that I was punished for refusing to communicate over the phone, and had my account closed.
(An account that it took the Minister of Health intervening on my behalf to open - Centrelink are incapable of assessing my illness, and thus my account always ends up in a limbo of processing, without me receiving benefits, whilst still being incapable of most work.)
Similar things exist with the Tax Office, the security puss that is mygov, and so on.
I've had similar stories from friends out of the UK and France. Governments don't know how to deal with situations where they cannot just say that they are the authority.
Phone numbers cannot be used as sole auth.
This also shows the total flaw in the phone infra. Why can't I rely on the phone number I see?